WebRTC leak test
WebRTC can hand a website IP addresses your browser knows about — including ones your proxy or VPN did not cover. This test gathers the addresses WebRTC offers and compares each public one with the address your HTTP traffic actually comes from, so you can see whether a site would spot the difference.
Gathering ICE candidates from public STUN servers for a few seconds…
- runningCollecting candidates…
Honest limit. A browser with WebRTC turned off shows nothing here — and “WebRTC disabled” is itself something a site can read. A .local host candidate is the normal, safe case: Chrome hides your LAN address behind a random mDNS name. The leak to worry about is a public address that differs from your HTTP IP.
Three kinds of candidate
To set up a peer connection, WebRTC collects “ICE candidates” — addresses your browser might be reachable on. A site can read them from JavaScript without asking permission, which is why they leak.
Host
Your local address. Modern Chrome replaces it with a random .local mDNS name, so a raw private IP here is a local leak.
Server-reflexive (srflx)
Your public address as a STUN server sees it. If it differs from your HTTP IP, a site sees two addresses.
Relay (relay)
An address via a TURN server, when one is configured. Not used in this test, which uses STUN only.
Stop WebRTC going around the proxy
A browser-only proxy or a VPN that does not cover WebRTC is the usual cause: HTTP goes through the tunnel, WebRTC finds the real address over UDP. Extensions that “disable WebRTC” trade one signal for another. With a proxy attached and block-non-proxied-UDP on by default, Mosaic runs the engine so WebRTC cannot send UDP around the proxy and expose the real address — it stops WebRTC going around the proxy, rather than routing WebRTC through it.
- Run the test. The page opens a WebRTC connection to public STUN servers and collects the ICE candidates your browser offers, for about five seconds.
- Compare the addresses. Each public (server-reflexive) candidate is compared with the IP the server saw over HTTP. A different one is an address a site can read that your proxy or VPN did not cover.
- Read the verdict. The tool says whether WebRTC exposed an address beyond your HTTP IP, and whether a local address leaked without mDNS obfuscation.
What is a WebRTC leak?
WebRTC can discover and share IP addresses to set up peer connections. If your browser offers a public address that your proxy or VPN did not cover, a site reading WebRTC candidates sees an address different from your HTTP traffic — and can tell the two apart.
The test shows a .local address. Is that a leak?
No. Modern Chrome replaces your local IP with a random mDNS name ending in .local, so a site cannot read your real LAN address. A raw private IP (like 192.168.x.x) showing instead would be a local leak, and the test calls that out.
How does Mosaic handle WebRTC?
With a proxy attached and block-non-proxied-UDP on by default, Mosaic runs the engine so WebRTC cannot send UDP around the proxy and expose your real address. That stops WebRTC going around the proxy; it does not route WebRTC through the proxy.
Every account its own browser. One price for all of them.
Free holds 3 profiles and 10 profile creations, with no card. Pro is $49 a month for any number, or $490 a year with 2 months free. Try it for 14 days; cancel before day 14 and you pay nothing.